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IN THE MATTER OF 
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IN THE DISTRICT COURT 

STATE OF TEXAS 


and 

§ 

§ 

§ 

§ 

§ 

§ 

TRAVIS COUNTY, TEXAS 

THE NEIMAN MARCUS GROUP, LLC., 
Respondent. 

JUDICIAL DISTRICT 


ASSURANCE OF VOLUNTARY COMPLIANCE 


This Assurance of Voluntary Compliance 1 (“Assurance”) is entered into by the Attorneys 
General of Alaska, Arizona 2 , Arkansas, Colorado, Connecticut 3 , Delaware, Florida, Georgia, 
Hawaii 4 , Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland 5 , 


1 This Assurance of Voluntary Compliance shall, for all necessary purposes, also be considered an Assurance of 
Discontinuance unless otherwise indicated herein or, in Delaware, a cease and desist order by agreement pursuant to 
29 Del. C. § 2525(a). The term “Assurance” as used herein may refer to the Assurance of Voluntary Compliance or 
an Assurance of Discontinuance, as applicable. No state-specific language or provision included in a footnote or 
appendix herein shall affect the interpretation, construction, or enforcement of the Assurance with respect to any 
signatory State not referenced in such footnote or appendix. 

2 The State of Arizona, ex rel. Mark Bmovich, Attorney General, and NEIMAN MARCUS have agreed to entry into 
the settlement, of which the Assurance is a part, pursuant to Arizona Revised Statutes (“A.R.S.”) § 44-1530 of the 
Arizona Consumer Fraud Act, A.R.S. §§ 44-1521 to 44-1534. NEIMAN MARCUS has consented and stipulated to 
the terms of this Assurance, and has agreed to enter into it, to compromise and settle claims in connection with the 
multi-state investigation by the State Attorneys General listed in this paragraph. 

For ease of reference, this entire group will be referred to collectively herein as the “Attorneys General” or 
individually as “Attorney General.” Such designations, however, as they pertain to Connecticut, shall refer to the 
Attorney General, both acting on his own behalf and as authorized by the Commissioner of the Department of 
Consumer Protection. “Connecticut Attorney General” shall mean only the Attorney General. 

4 Hawaii is represented by its Office of Consumer Protection, an agency which is not part of the state Attorney 
General’s Office, but which is statutorily authorized to undertake consumer protection functions, including legal 
representation of the State of Hawaii. For ease of reference, the entire group will be referred to as the “Attorneys 
General,’ or individually as “Attorney General" and the designations, as they pertain to Hawaii, refer to the Executive 
Director of the State of Hawaii Office of Consumer Protection. 

' For ease of reference, this entire group will be referred to collectively herein as the “Attorneys General” or 
individually as “Attorney General.” Such designations, however, as they pertain to Maryland, shall refer to the 
Consumer Protection Division of the Office of the Maryland Attorney General. 



Massachusetts, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, New Hampshire, 
New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, 
Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah 6 , Vermont 7 , 
Virginia, and Washington, as well as the District of Columbia (referred to collectively as the 
“Attorneys General”) and The Neiman Marcus Group, LLC (“NEIMAN MARCUS”; collectively, 
with the Attorneys General, the “Parties”) to resolve the investigation by the Attorneys General 
into the security incident announced by NEIMAN MARCUS on or about January 10, 2014 (the 
“Intrusion”). 

In consideration of their mutual agreement to the terms of this Assurance, and such other 
consideration as described herein, the sufficiency of which is hereby acknowledged, the Parties 
hereby agree as follows: 

I. INTRODUCTION 

This Assurance constitutes a good faith settlement and release between NEIMAN 
MARCUS and the Attorneys General of claims related to the Intrusion, publicly announced by 
NEIMAN MARCUS on January 10, 2014, in which a person or persons gained unauthorized 
access to portions of NEIMAN MARCUS’s computer systems that process payment card 
transactions at NEIMAN MARCUS’s retail stores. 

II. DEFINITIONS 

1. For the purposes of this Assurance, the following definitions shall apply: 

6 The Utah Attorney General’s Office represents the Utah Division of Consumer Protection (Division), the state agency 
charged with enforcement of the Consumer Sales Practices Act, in this action. As to “Utah” the definition of Attorneys 
General means the Utah Attorney General as counsel to the Division. 

7 For Vermont, in lieu of instituting an action or proceeding against NEIMAN MARCUS, the Office of the Attorney 
General, pursuant to 9 V.S.A. § 2459, accepts this Assurance of Discontinuance. By signing below, NEIMAN MARCUS 
voluntarily agrees with and submits to the terms of this Assurance of Discontinuance. 



A. “Cardholder Data Environment” shall mean NEIMAN MARCUS’s 
technologies that store, process, or transmit payment card authentication 
data, consistent with the Payment Card Industry Data Security Standard 
(“PCI DSS”). 

B. "Compensating Controls” shall mean alternative mechanisms that are put in 
place to satisfy the requirement for a security measure that is determined by 
the Chief Information Security Officer or his or her designee to be 
impractical to implement at the present time due to legitimate technical or 
business constraints. Compensating Controls must be suitable to protect the 
system and consistent with current industry accepted security protocols. The 
determination to implement Compensating Controls must be accompanied 
by written documentation demonstrating that a risk analysis was performed 
indicating the gap between the original security measure and the proposed 
alternative measure, that the Compensating Control was determined to be 
acceptable in light of such risk, and that the Chief Information Security 
Officer agrees with both the risk analysis and the determination that the 
Compensating Control is acceptable in light of such risk. 

C. “Consumer” shall mean any individual who initiates a purchase of or 
purchases goods from a NEIMAN MARCUS retail location, any individual 
who returns merchandise to a NEIMAN MARCUS retail location; or any 
individual who otherwise provides Personal Information to NEIMAN 



MARCUS in connection with any other retail transaction at a NEIMAN 
MARCUS retail location. 

D. “Consumer Protection Acts” shall mean the State citations listed in 
Appendix A 8 . 

E. “Effective Date” shall be February 8, 2019. 

F. “Personal Information” shall mean the data elements in the definition of 
personal information set forth in the Security Breach Notification Act and/ 
or Personal Information Protection Act. 9 

G. “Personal Information Protection Acts” shall mean the State citations listed 
in Appendix B. 

H. “Security Breach Notification Acts” shall mean the State citations listed in 
Appendix B. 

I. "NEIMAN MARCUS” shall mean The Neiman Marcus Group, LLC, its 
affiliates, subsidiaries and divisions, successors and assigns doing business 
in the United States. 

J. “Security Event” shall mean any compromise to the confidentiality, 
integrity, or availability of a NEIMAN MARCUS information asset that 
includes Personal Information. 

III. APPLICATION 


8 Appendix A: State Consumer Protection Acts. 

9 See Appendix B: State Security Breach Notification Acts and/or Personal Information Protection Acts. 



2. The duties, responsibilities, burdens, and obligations undertaken in connection with 
this Assurance shall apply to NEIMAN MARCUS, its affiliates, subsidiaries, successors and 
assigns, and its officers and employees. 

IV. ASSURANCES 

3. NEIMAN MARCUS shall comply with the PCI DSS with respect to its Cardholder 
Data Environment and any NEIMAN MARCUS system component the compromise of which 
NEIMAN MARCUS reasonably believes would impact the security of the Cardholder Data 
Environment. 

4. NEIMAN MARCUS shall maintain an appropriate system to collect and monitor 
network activity, such as through the use of a security information and event management tool, as 
well as appropriate policies and procedures to ensure that such a tool is properly configured to 
report anomalous activity. NEIMAN MARCUS shall ensure that logs are regularly reviewed and 
monitored in near real-time. 

5. NEIMAN MARCUS shall at all times maintain a current non-disclosure agreement 
with a minimum of two (2) separate, qualified Payment Card Industry forensic investigators 
(“PFIs”) capable of performing an investigation to determine whether a Security Event has 
occurred, at least one of which has not performed work in connection with NEIMAN MARCUS’s 
PCI DSS Report on Compliance for the year during or preceding the potential Security Event. 

6. NEIMAN MARCUS shall maintain and keep up-to-date all software associated 
with its maintenance and safeguarding of Personal Information within the Cardholder Data 
Environment, or within any network directly connected or accessible to the Cardholder Data 
Environment (collectively, the “Environment”), or maintain appropriate Compensating Controls 



to safeguard the confidentiality and integrity of such Personal Information. If any such software is 
reaching the end of its life or an end of support date, NEIMAN MARCUS must generate a written 
plan for either the replacement of such software or continued support and updating of such 
software. 

7. NEIMAN MARCUS shall implement where appropriate steps designed to 
reasonably manage the review of industry-accepted payment card security technologies relevant 
to NEIMAN MARCUS'S business, such as chip and PIN technology. Where appropriate and 
reasonable, NEIMAN MARCUS shall adopt any such improvements. 

8. NEIMAN MARCUS shall devalue payment card information, including, but not 
limited to, encryption and/or tokenization, to obfuscate payment card information throughout the 
course of retail transactions at NEIMAN MARCUS retail locations. 

V. SETTLEMENT COMPLIANCE ASSESSMENT 

9. NEIMAN MARCUS shall obtain an information security assessment and report 
from a third-party professional (“Third-Party Assessor”) to assess NEIMAN MARCUS’S handling 
of Personal Information and compliance with its information security program within the 
Environment, using procedures and standards generally accepted in the profession (“Third-Party 
Assessment”), within the earlier of two (2) years after the Effective Date of this Assurance, or one 
hundred and eighty (180) days after NEIMAN MARCUS completes the migration of its data center 
that is currently underway. The Third-Party Assessor’s report on the Third-Party Assessment 
(“Third-Party Assessor’s Report” or “Report”) shall: 

A. Set forth the specific administrative, technical, and physical safeguards 
maintained by NEIMAN MARCUS; 




B. Explain the extent to which such safeguards that have been implemented 
meet the requirements of NEIMAN MARCUS’S information security 
program, taking into account NEIMAN MARCUS’S size and complexity, 
the nature and scope of NEIMAN MARCUS’s activities, and the sensitivity 
of the Personal Information maintained by NEIMAN MARCUS; and 

C. Identify NEIMAN MARCUS’s Qualified Security Assessor for purposes of 
PCI DSS compliance. 

10. NEIMAN MARCUS’s Third-Party Assessor shall: (a) be a Certified Information 
Systems Security Professional (“CISSP”), or a Certified Information Systems Auditor (“CISA”), 
or a similarly qualified person or organization; and (b) have at least five (5) years of experience 
evaluating the effectiveness of computer systems or information system security. 

VI. SUBMISSION TO ATTORNEYS GENERAL 

11. NEIMAN MARCUS shall provide a copy of the Third-Party Assessor’s Report to 
the Connecticut Attorney General within one hundred and eighty (180) days of the completion of 
the Report. At that time, NEIMAN MARCUS may also submit a separate report (the “Response 
Report'’) to the Connecticut Attorney General that describes any corrective actions that NEIMAN 
MARCUS may have taken or may plan to take as a result of the Third-Party Assessment. Should 
the Connecticut Attorney General have concerns about the Third-Party Assessor’s Report after 
taking into account the Response Report that it believes may require further action, it will discuss 
those concerns with NEIMAN MARCUS, which promptly will take all reasonable steps to perform 
additional corrective action. 



a. Confidentiality: The Connecticut Attorney General’s Office shall, to the extent 
permitted by the laws of the State of Connecticut, treat the Report and any 
Response Report received from NEIMAN MARCUS as exempt from 
disclosure under the relevant public records laws (see, e.g., Conn. Gen. Stat. §§ 
1-210(b)(5)(A) and (B) and 1-210(b)(20)), in light of the fact that the Report 
and Response Report will likely contain sensitive cybersecurity and network 
information that may have the potential to compromise the security of 
NEIMAN MARCUS’S computer networks. 

b. Signatory State Access to Report: The Connecticut Attorney General’s Office 
may provide a copy of the Report or Response Report to any other participating 
Attorneys General upon request, and each requesting Attorney General shall, to 
the extent permitted by the laws of the Attorney General's State, treat such 
Report or Response Report as exempt from disclosure under the relevant public 
records laws. 

c. Should any Attorney General receive any request to produce the Report or 
Response Report under the relevant public records laws, and the Attorney 
General intends to produce the Report or Response Report, the Attorney 
General shall notify NEIMAN MARCUS of such request no later than ten (10) 
days before producing documents in response to such a request, to the extent 
permitted by state law, or with any required lesser advance notice. In this event, 
NEIMAN MARCUS shall bear any burden to prevent disclosure if it desires to 


do so. 



VII. PAYMENT TO THE STATES 


12. NEIMAN MARCUS shall pay One Million, Five Hundred Thousand Dollars 
($1,500,000.00) to the Attorneys General. Said payment shall be divided and paid by NEIMAN 
MARCUS directly to each of the Attorneys General in an amount designated by the Attorneys 
General and communicated to NEIMAN MARCUS by the Connecticut Attorney General and 
Illinois Attorney General, as the lead states of the multistate investigation. Each of the Attorneys 
General agrees that the Connecticut Attorney General and Illinois Attorney General have the 
authority to communicate the designated amount to be paid by NEIMAN MARCUS to each 
Attorney General and to provide NEIMAN MARCUS with instructions for the payments to be 
distributed under this Paragraph. 10 Payment shall be made no later than thirty (30) days after the 
Effective Date of this Assurance and receipt of such payment instructions by NEIMAN MARCUS 
from the Connecticut Attorney General and Illinois Attorney General, except that where state law 
requires judicial or other approval of the Assurance, payment shall be made no later than thirty 
(30) days after notice from the relevant Attorney General that such final approval for the Assurance 
has been secured. 11 

13. Said payment shall be used by the Attorneys General for such purposes that may 
include, but are not limited to, being placed in, or applied to, any consumer protection law 
enforcement fund, including future consumer protection or privacy enforcement, consumer 
education, litigation or local consumer aid fund or revolving fund, used to defray costs of the 

10 Certain States have requested that their share of this payment be listed. These States may add an Appendix E 
indicating their state-specific amount. 

" NEIMAN MARCUS and the Attorney General of North Carolina agree that NEIMAN MARCUS’S payment to 
North Carolina shall be made within 30 days of the Effective Date. 



inquiry leading hereto, or for attorneys’ fees and other costs of investigation, or for other uses 


permitted by state law, at the sole discretion of the Attorneys General. 12 

VIII. RELEASE 

14. Following full payment of the amounts due under this Assurance, the Attorneys 
General shall hereby release and discharge NEIMAN MARCUS from all civil claims that the 
Attorneys General could have brought under the Consumer Protection Acts, the Personal 
Information Protection Acts, and the Security Breach Notification Acts based on NEIMAN 
MARCUS’s conduct related to the Intrusion. Nothing contained in this paragraph shall be 
construed to limit the ability ot the Attorneys General to enforce the obligations that NEIMAN 
MARCUS has under this Assurance. Further, nothing in this Assurance shall be construed to 
create, waive, limit, settle, release, or resolve any private right of action, including such private 
causes of action, claims or remedies that could be brought under the statutes listed in Appendix A 
and Appendix B. 13 14 

IX. PRESERVATION OF AUTHORITY 


12 Certain States have requested that the legally permissible uses of their share of the payment be described. These 
states may add an Appendix E indicating such uses. 

13 Consistent with this paragraph, NEIMAN MARCUS and the Attorney General of Minnesota agree that as to 
Minnesota, the Attorney General of Minnesota through this Assurance does not settle, release, or resolve any claim 
against NEIMAN MARCUS or any other person or entity involving any private causes of action, claims, and remedies 
including, but not limited to, private causes of action, claims, or remedies provided for under Minn. Stat. § 8.31. This 
footnote shall not affect the interpretation, construction, or enforcement of the Assurance with respect to any signatory 
State other than Minnesota. 

14 NEIMAN MARCUS and the Attorney General of Michigan agree that as to Michigan, nothing in this Assurance 
shall be construed to limit or release any criminal enforcement action, claims of any other Michigan local, state, or 
governmental agency having specific regulatory authority that is separate from the regulatory and enforcement 
jurisdiction of the Attorney General of Michigan, or claims arising from violation of state or federal antitrust law, state 
or federal securities law, or state or federal tax law. This footnote shall not affect the interpretation, construction, or 
enforcement of the Assurance with respect to any signatory State other than Michigan. 



15. Nothing in this Assurance shall be construed to limit the authority or ability of an 
Attorney General to protect the interests of his/her State or the people of his/her State. This 
Assurance shall not bar the Attorney General or any other governmental entity from enforcing 
laws, regulations, or rules against NEIMAN MARCUS for conduct subsequent to or otherwise not 
covered by this Assurance. Further, nothing in this Assurance shall be construed to limit the ability 
of the Attorney General to enforce the obligations that NEIMAN MARCUS has under this 
Assurance. 

X. GENERAL PROVISIONS 

16. The Parties understand and agree that this Assurance shall not be construed as an 
approval or a sanction by the Attorneys General of NEIMAN MARCUS’S business practices, nor 
shall NEIMAN MARCUS represent that this Assurance constitutes an approval or sanction of its 
business practices. The Parties further understand and agree that any failure by the Attorneys 
General to take any action in response to any information submitted pursuant to this Assurance 
shall not be construed as an approval or sanction of any representations, acts, or practices indicated 
by such information, nor shall it preclude action thereon at a later date. 

17. Nothing in this Assurance shall be construed as relieving NEIMAN MARCUS of 
the obligation to comply with all applicable state and federal laws, regulations, and rules, nor shall 
any of the provisions of this Assurance be deemed to be permission to engage in any acts or 
practices prohibited by such laws, regulations, and rules. 

18. As to each individual signatory State, this Assurance shall be governed by the laws 
of that State without regard to any conflict of laws principles. 



19. NEIMAN MARCUS shall deliver a copy of this Assurance to, or otherwise fully 
apprise, each of its current officers of the rank of executive vice president or above, the executive 
management officer having decision-making authority with respect to the subject matter of this 
Assurance, and each member of its Board of Directors within ninety (90) days of the Effective 
Date. NEIMAN MARCUS shall deliver a copy of this Assurance to, or otherwise fully apprise, 
any new officers of the rank of executive vice president or above, new executive management 
officer having decision-making authority with respect to the subject matter of this Assurance, and 
each new member of its Board of Directors, within ninety (90) days from which such person 
assumes his/her position with NEIMAN MARCUS. 

20. In states where statute requires that this Assurance be filed with and/or approved 
by a court, NEIMAN MARCUS consents to the filing of this Assurance and to its approval by a 
court, and authorizes the Attorneys General in such states to represent that NEIMAN MARCUS 
does not object to the request that the court approve the Assurance. NEIMAN MARCUS further 
consents to be subject to the jurisdiction of such courts (if legally required) for the exclusive 
purposes of having such courts approve or enforce this Assurance. To the extent that there are any 
court costs associated with the filing of this Assurance (if legally required), NEIMAN MARCUS 
agrees to pay such costs. State-specific provisions regarding the filing of the Assurance are set out 
in Appendix D. 15 


15 States that will be filing this Assurance with a court, and in some cases be seeking approval of the Assurance by a 
court, pursuant to statutory requirements, are Alaska, Arizona, Georgia, Idaho, Indiana, Kentucky, Louisiana, Maine, 
Massachusetts, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, New Hampshire, North Dakota, 
Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Vermont, Virginia, and Washington. 
NEIMAN MARCUS understands each state will conform the form of the Assurance in accordance with statute, rule 
or practice and may add a cover page or caption to the document. 



21. NEIMAN MARCUS shall not participate in any activity or form a separate entity 
or corporation for the purpose of engaging in acts or practices in whole or in part that are prohibited 
by this Assurance or for any other purpose that would otherwise circumvent any term of this 
Assurance. NEIMAN MARCUS shall not knowingly cause, permit, or encourage any other 
persons or entities acting on its behalf, to engage in practices prohibited by this Assurance. 

22. This Assurance may be executed by any number of counterparts and by different 
signatories on separate counterparts, each of which shall constitute an original counterpart thereof 
and all ot which together shall constitute one and the same document. One or more counterparts 
of this Assurance may be delivered by facsimile or electronic transmission with the intent that it 
or they shall constitute an original counterpart thereof. 

23. The undersigned NEIMAN MARCUS representatives state that they are authorized 
to enter into and execute this Assurance of Voluntary Compliance on behalf of NEIMAN 
MARCUS and, further agree to execute and deliver all authorizations, documents and instruments 
which are necessary to carry out the terms and conditions of this Assurance of Voluntary 
Compliance. 

24. NEIMAN MARCUS agrees that this Assurance does not entitle it to seek or to 
obtain attorneys' fees as a prevailing party under any statute, regulation, or rule, and NEIMAN 
MARCUS further waives any right to attorneys’ fees related to this Assurance that may arise under 
such statute, regulation, or rule. 

25. This Assurance shall not be construed to waive any claims of sovereign immunity 
the States may have in any action or proceeding. 



26. This Assurance is not intended for use by any third party in any other proceeding 
and is not intended, and should not be construed as an admission of any fact or legal conclusion 
related to the Intrusion, or of any wrongdoing or liability by NEIMAN MARCUS. 

27. The obligations and other provisions of this Assurance set forth in paragraphs 3— 
5 and 8 shall expire at the conclusion of the six (6) year period after the Effective Date of this 
Assurance, unless they have expired at an earlier date pursuant to their specific terms. 

XI. SEVERABILITY 

28. If any clause, provision, or section of this Assurance shall, for any reason, be held 
illegal, invalid, or unenforceable, such illegality, invalidity or unenforceability shall not affect any 
other clause, provision or section of this Assurance and this Assurance shall be construed and 
enforced as if such illegal, invalid or unenforceable clause, section or provision had not been 
contained herein. 

XII. NOTICE/DELIVERY OF DOCUMENTS 

29. Whenever NEIMAN MARCUS shall provide notice to the Attorneys General under 
this Assurance, that requirement shall be satisfied by sending notice to the Designated Contacts on 
behalf of the Attorneys General listed in Appendix C. Any notices or other documents sent to 
NEIMAN MARCUS pursuant to this Assurance shall be sent to the following address: 

The Neiman Marcus Group, LLC 

ATTN: Tracy M. Preston, Senior Vice President and General Counsel 

1618 Main Street 


Dallas, TX 75201 



All notices or other documents to be provided under this Assurance shall be sent by United States 
mail, certified mail return receipt requested, or other nationally recognized courier service that 
provides for tracking services and identification of the person signing for the notice or document, 
and shall have been deemed to be sent upon mailing. Any party may update its address by sending 
written notice to the other party. 



Consented and agreed to by: 

The Neiman Marcus Group, LLC 


By: 



Tracy M. Prds 
Senior Vice President and General Counsel 
1618 Main St, Dallas, TX 75201 


Date: 


By: 


c 


vU~~^ 

David H. Hoffman 17 


david.hoffman@sidley.com 
Daniel C. Craig 
SIDLEY AUSTIN LLP 

One South Dearborn Street, Chicago, Illinois 60603 


Edward R. McNicholas 
SIDLEY AUSTIN LLP 
1501 K. Street, N.W., Washington, D.C. 20005 


Anthony Jannotta 
COOLEY LLP 

1114 Avenue of the Americas, New York, NY 10036 


Counsel to The Neiman Marcus Group, LLC 


January 7, 2019 


January 7. 2019 
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ATTORNEYS FOR THE STATE OF TEXAS 


KEN PAXTON 
Attorney General of Texas 

JEFFREY C. MATEER 
First Assistant Attorney General 

BRANTLEY STARR 

Deputy First Assistant Attorney General 

DARREN L. MCCARTY 

Deputy Attorney General for Civil Litigation 

PAUL SINGER 

Chief, Consumer Protection Division 

" p . <££ 1 U . (Aht*x 

D. ESTHER CHAVEZ Q 

Senior Assistant Attorney General^^ 

State Bar No. 04162200 

Office of the Texas Attorney General 

P.O. Box 12548 

Austin, Texas 78711-2548 

Phone:(512) 475-4628 

Facsimile: (512) 463-1267 

Email: Esther.Chavez@oaa.texas.uov 

Date: ■JaiJ % lOft 
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